CVE-2026-48087 in appointment-booking-software
Summary
by MITRE • 08/07/2026
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, the registration handler at `POST /api/auth/register/{userId}` validates the relationship between the WebAuthn challenge and the registration cookie's email but never validates that the `userId` in the URL belongs to that email. An unauthenticated attacker requests a challenge for their own email, generates a registration response with their own authenticator, and submits it against any victim user's URL. The challenge-vs-cookie email match passes, the WebAuthn ceremony validates, and `addPasskey` writes the attacker's credential into the victim's `user_passkey` rows. The next victim-email login accepts a passkey assertion from the attacker's authenticator and issues a session as the victim. User IDs are not strictly secret on this platform, but the exact set of exposure surfaces should be assessed by the maintainers. Staff-list endpoints return user IDs to authenticated tenant members per the route signature; live verification of all exposure surfaces (whether user IDs leak through any unauthenticated route, through invite-confirmation URLs, or through other administrative views) is part of the pending live PoC. Where the attacker knows the victim's email and userId, the analysis below becomes account takeover. Version 1.0.2 fixes the issue.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/07/2026
This vulnerability in OpenReception's appointment booking software represents a critical authentication bypass flaw that allows unauthenticated attackers to hijack user accounts through improper validation of user identifiers during WebAuthn registration processes. The vulnerability exists in the registration handler at POST /api/auth/register/{userId} where the system performs validation between the WebAuthn challenge and registration cookie's email address but fails to verify that the userId parameter in the URL corresponds to the email address contained within the cookie. This logical gap enables attackers to exploit the system's trust model by first obtaining a valid WebAuthn challenge for their own email address, then generating a legitimate authentication response using their own authenticator device. The registration process subsequently accepts this attacker-controlled credential and associates it with any victim user's account through the URL's userId parameter, effectively allowing the attacker to impersonate the victim within the system.
The technical implementation of this vulnerability stems from a fundamental flaw in access control validation where the system assumes that if the challenge matches the cookie email, then the entire registration process is legitimate. This approach violates the principle of least privilege and fails to implement proper authorization checks before accepting authentication credentials. The WebAuthn specification requires that credential registration processes verify not only the cryptographic validity of the assertion but also that the registration request originates from an authorized user context. In this case, the system's failure to validate the userId parameter against the authenticated cookie context creates a path for account takeover attacks. According to CWE-285, this represents an authorization bypass vulnerability where insufficient validation of user identity during credential registration allows unauthorized users to associate authenticators with arbitrary accounts.
The operational impact of this vulnerability extends beyond simple privilege escalation into full account takeover scenarios that can compromise sensitive user data and system integrity. Attackers who know a victim's email address and userId can execute this attack without requiring prior authentication or access to the victim's credentials. The attack chain becomes particularly dangerous because it leverages the trust model inherent in WebAuthn implementations while exploiting the platform's failure to validate user context properly. Once the attacker successfully registers their authenticator with the victim's account, any subsequent login attempt using the victim's email address will accept assertions from the attacker's authenticator device, thereby establishing a session as the victim user. This creates persistent unauthorized access that could remain undetected for extended periods.
This vulnerability aligns with several ATT&CK framework techniques including T1566 for credential harvesting and T1078 for valid accounts, as it enables attackers to obtain and utilize valid authentication credentials without traditional brute force or password guessing methods. The attack pattern demonstrates how improper input validation and authorization checks can create persistent security weaknesses that allow attackers to establish long-term access to compromised accounts. Security practitioners should recognize this as a classic example of how insufficient parameter validation in web applications can lead to critical privilege escalation vulnerabilities. Additionally, the vulnerability exposes potential information disclosure issues where user IDs may be exposed through various API endpoints, creating additional attack surface that could be leveraged by attackers with partial knowledge of victim identities. The fix implemented in version 1.0.2 addresses the core issue by ensuring proper validation of userId parameters against authenticated contexts, thereby preventing unauthorized credential association with accounts. Organizations should conduct thorough security assessments to identify similar patterns in their own applications and implement comprehensive input validation and authorization checks as recommended by industry standards including NIST SP 800-53 controls for authentication and access control.